Home : Security : News

Critical JavaScript flaw hits Firefox 3.5

Mozilla has confirmed a critical vulnerability in its JavaScript compiler.

By Nicole Kobie, 15 Jul 2009 at 16:02

A newly-discovered critical flaw in Firefox 3.5's JavaScript compiler could be used to execute malicious code, Mozilla developers have admitted.

According to the Mozilla security blog, the vulnerability in the Just-in-time JavaScript compiler was discovered last week - just over a week after Firefox 3.5 was made available for download. The TraceMonkey JavaScript engine has been patched once already.

"Mozilla developers are working on a fix for this issue and a Firefox security update will be sent out as soon as the fix is completed and tested," Mozilla noted on its security blog.

In the mean time, users should either run Firefox in Safe Mode or disable the compiler. Mozilla gave instructions on how to do that here, but acknowledged it would hurt JavaScript performance. The flaw can only be exploited if a Firefox user visits a web page containing malicious code.

Click here for our review of Firefox 3.5 - and here to learn more about the browser.

Email to a friend

Print this page

< Previous Security : News Next >

2 comments

You need to Login or Register to comment.

The fix is out

Firefox 3.5.1 has been released, the update contains the patch for this security hole.

Pretty fast work. :)

By greenknight32 on Friday Jul 17

Mozilla on the ball.

"The TraceMonkey JavaScript engine has been patched once already."

Really? Surely you would be concerned if the newly built software *wasn't* being patched, wouldn't you?

You've all been living in Microsoft dreamworld for too long. Wake up!!!

By 6tricky9 on Sunday Jul 19

Latest Security Analysis & Insight

What is your password worth?

Would you be tempted to sell off company passwords for a fee? If not, seems like you're in the minority, acccording to research.

More Security Analysis & Insight

Latest Security Reviews

Check Point 2210 Appliance review

Rating:

Check Point's new 2200 Appliances combined enterprise level network security with an SMB price tag. Its software blades provide a wealth of features, but do they complicate deployment? Read this exclusive review to find out.

More Security Reviews